CVE-2026-77028 describes a reflected XSS and open redirect vulnerability in the yootheme.com Zoo extension for Joomla. The flaw is due to improper input neutralization in the submission redirect parameter in versions 1.0.0 up to and including 4.1.65. This allows an attacker to inject malicious scripts or redirect users to unintended URLs. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website or redirect users to malicious sites. This can lead to session hijacking, phishing, or other user-targeted attacks. However, the impact is rated medium due to the requirement of user interaction and limited scope of confidentiality, integrity, and availability impact.

No official fix or patch has been confirmed or published at this time. Users should monitor the vendor's advisory channels for updates. Until a patch is available, consider implementing input validation or filtering on the submission redirect parameter as a temporary mitigation. Avoid clicking suspicious links that may exploit this vulnerability.